This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

wireshark 1.6.2 win64 sees only Ethernet NIC

0

I have D-Link DWA-120 USB WiFi card and PPTP VPN connection on my PC. They both look like NICs in Windows, but Wireshark sees only "wired" NIC as capture device. Why?

asked 25 Oct '11, 12:48

ZZWave's gravatar image

ZZWave
1111
accept rate: 0%

where do you take the information that wireshark sees "wired" NICs from ? Did you check Capture Interface Details ?

(27 Oct '11, 01:57) Landi

There is only Realtek wired NIC, both in capture devices and in settings. WiFi and VPN aren't "hidden" or something like this.

(27 Oct '11, 02:05) ZZWave

What does wireshark.exe -D show when run from a command prompt? That lists all the interfaces that Wireshark can capture on.

Note that depending on your Windows version, captures by WinPCap (the mechanism Wireshark uses to capture on Windows) might not be possible for PPP interfaces. See here for more info

(27 Oct '11, 02:20) grahamb ♦
  1. DeviceNPF_{C3A47C49-2DDD-4E43-A10D-00C9F423377A} (Realtek RTL8168C/8111C PCI-E Gigabit Ethernet NIC)
  2. DeviceNPF_{11ED76E7-289D-4D50-841A-1DC7602ED1F6} (Microsoft)

WinPcap 4.1.2

(27 Oct '11, 08:42) ZZWave

The first one is your wired connection, the second one could be ???

Can you match the GUID listed to one in the output from "ipconfig /all"?

It's somewhat hard to tie the GUIDs up to actual interfaces, I can give you a PowerShell method to get more info if you want.

(27 Oct '11, 09:08) grahamb ♦

Second is "Microsoft ISATAP adapter"....

(27 Oct '11, 09:59) ZZWave

I've converted your "answer" to another comment.

So, it appears that the only two interfaces WinPCap can see on your machine are the Wired NIC and the ISATAP interface. For whatever reason your Wireless adaptor can't be seen. This is sometimes a problem on Windows, see here for more info.

Microsoft Network Monitor can usually capture on the interfaces you want, and the captures can be saved and then opened in Wireshark.

(27 Oct '11, 11:24) grahamb ♦
showing 5 of 7 show 2 more comments